Security audit
Security checks for vulnerabilities and agentic risk
This research skill is not malicious, but it asks agents to use monitoring, memory storage, scheduling, and shell-style execution without enough user controls or scope limits.
Install only if you are comfortable with a research assistant that may search the web, store research data, and create recurring monitoring jobs. Before using it, set explicit limits for research scope, monitoring duration, storage location, deletion, and require confirmation before any exec command or scheduled task is used.
The file declares runtime: prompt_only, but later describes operation via external tools such as exec, web_fetch, memory/store, scheduling, and search. This mismatch can mislead reviewers and deployment systems about the skill's capabilities, causing it to be approved or invoked under weaker assumptions than its documented behavior warrants.
The skill advertises continuous monitoring and update notifications, but does not warn users that this implies persistent observation, repeated external access, and possible outbound alerts. That creates consent and privacy risks, especially if users do not realize the behavior continues beyond the initial request.
The knowledge-graph and raw-data storage features describe retaining collected entities, relations, and appendices without any retention, minimization, or sensitivity guidance. Research tasks can easily collect personal, proprietary, or copyrighted material, so undocumented storage increases privacy and compliance risk.
The activation phrases are broad, natural-language requests such as '帮我研究一下...' and '持续监控...'. Without scope limits, confirmation gates, or task-boundary rules, the skill may trigger on ordinary conversation and start wide research, monitoring, or data-collection behaviors the user did not intend to authorize.
The skill is presented as a research assistant, but the documented OpenClaw adaptation maps functionality to an exec tool without constraining what commands may run or why shell execution is required. Even in documentation, introducing generic command execution expands the implied privilege boundary and can lead downstream agents or integrators to invoke local commands for untrusted research tasks, increasing command-injection and unintended system-action risk.
The description, instructions, and activation examples are entirely in Chinese, which effectively forces a single language experience. There is no statement that the skill is China-specific or any option for the user to choose another language.
No suspicious patterns detected.
